AI Regulations in JAFZA: Complete Guide

Companies in the Jebel Ali Free Zone are adopting artificial intelligence in the places where the work actually happens: routing and scheduling, demand forecasting, warehouse automation, quality inspection, predictive maintenance, and increasingly in hiring. The question that follows is which rules apply. There is no separate AI statute for JAFZA companies. The obligations come from the law that already governs the activity, the personal data involved, the workforce affected and the licence the company holds from the free zone authority.

This guide sets out those obligations in the order a JAFZA business tends to meet them, from licensing through to liability when an automated system gets something wrong.

JAFZA is a free zone, not a separate legal system

Companies in the Jebel Ali Free Zone are registered and licensed by the free zone authority and operate under its rules on establishment, premises and activities. They remain subject to federal UAE law. Federal legislation on personal data, employment, commercial dealings and criminal liability applies to a JAFZA entity in the ordinary way.

That is a real distinction from the DIFC and ADGM, which are common-law jurisdictions with their own courts, their own regulators and their own data protection regimes. A compliance framework built for a group company in one of those centres does not transfer to a JAFZA entity, and assuming otherwise creates gaps that only appear when a customer, an insurer or an investor asks for evidence.

Licence scope comes first

A JAFZA licence permits defined activities. Automation inside the company's own operations generally sits within them. Selling the automation is a different matter. A logistics operator that packages its routing model and licenses it to other operators has moved into a software business, and a manufacturer that offers its inspection system to customers has done the same.

Before an internal tool becomes a product, confirm the licence covers the activity, and check whether the arrangement also needs anything beyond free zone licensing. Adding the activity in advance is straightforward; explaining afterwards why it was carried on without one is not.

Personal data in operational systems

Personal data handled by a JAFZA company is governed by the federal personal data protection law, Federal Decree-Law No. 45 of 2021. Operational AI touches personal data more often than people expect: driver telematics, warehouse productivity tracking, camera-based safety monitoring, and customer contact records feeding a service model.

The recurring points to settle are these:

• Basis for use. Data collected to run an operation is not automatically available to train a model. Reuse for training needs its own justification, recorded before the training run.
• What people were told. Notices given to staff, drivers and customers must describe what is actually happening, including monitoring and model development.
• Monitoring of workers. Location tracking, productivity scoring and camera analytics are intrusive by nature. Scope them to a stated purpose and keep them proportionate to it.
• Transfers abroad. Sending data to a group company, a cloud region or an overseas model provider is a regulated step, and the contract with the recipient carries part of the obligation.
• Retention. Training and telemetry datasets need a retention position rather than indefinite accumulation.

Vendors, integrators and the contract chain

Industrial AI usually arrives through a systems integrator or an equipment supplier rather than a model developer, which means the risk sits across several contracts at once. The terms worth reading closely are:

• Performance. What the system is actually promised to do, expressed in terms that can be tested, rather than what appeared in the demonstration.
• Use of your data. Whether the supplier may use operational data, images or telemetry from your site to improve its products, and whether that can be refused.
• Ownership. Who owns configurations, models trained on your data and any code written specifically for you.
• Liability. Where responsibility falls when an automated system damages goods, injures someone or halts a line, and whether the cap reflects that exposure.
• Continuity and support. What happens when a model version is retired or a supplier withdraws support for equipment already installed in a facility.

Where several suppliers contribute to one automated process, the boundaries between them should be written down. Disputes in this area are usually about which party's component caused the failure, and they are far shorter when the contracts say who owned which part of the chain.

Safety, workforce and employment law

Automation in a warehouse or plant sits alongside health and safety duties that do not move to the vendor. The employer remains responsible for a safe system of work, including where machinery is directed by software.

Employment relationships are governed by Federal Decree-Law No. 33 of 2021, which replaced Federal Law No. 8 of 1980. Systems that screen candidates, allocate shifts, score performance or feed into disciplinary decisions should be assessed before use: they process personal data about identifiable people, and a decision affecting an employee still has to be justifiable by reference to the employment framework, not to the model's output alone. Where automation changes roles or headcount, the process for doing so follows the same law as any other change to the workforce.

Accountability for automated decisions

A JAFZA company answers to its customers and counterparties for its own performance, whatever produced it. If a forecasting system misallocates stock or an inspection model passes defective goods, the customer's claim is against the company under its contract.

What makes that manageable is ordinary record keeping: which version of a system was running, what data it used, who reviewed the outcome and what they could override. Where a decision has real consequences for a person or a customer, human review should be genuine rather than a signature applied to whatever the system produced.

Disputes

Claims arising from automated systems are commercial claims in unfamiliar dress: underperformance against specification, data used outside the agreed scope, ownership arguments over models and configurations, and loss following an automated failure. Settle the forum in the contract. Arbitration in the UAE is governed by Federal Law No. 6 of 2018, as amended in 2023. Note that institutional choices changed: the DIFC-LCIA Arbitration Centre was abolished by Dubai Decree No. 34 of 2021 and its caseload moved to the Dubai International Arbitration Centre, so older supply agreements naming it need correcting. Clear drafting at signature removes most of the groundwork for later technology dispute resolution.

Conclusion

For a JAFZA business, AI compliance is a short sequence of practical checks. Does the licence cover the activity, particularly if an internal tool is becoming a product? Is there a lawful basis under the federal data protection law for the data behind the model, including data about staff? Do the supplier contracts allocate performance and liability in a way the business would defend? Can the company show who was accountable for an automated outcome?

Answering those before installation is straightforward. Reconstructing the answers after an incident rarely is.

For guidance on automation projects, data protection or supplier contracts in JAFZA, contact the Nour Attorneys team.

Schedule Your Consultation

Disclaimer: The information provided in this article is for general informational purposes only and does not constitute legal advice. Readers should seek professional legal advice tailored to their specific circumstances before making any decisions or taking any action based on the content of this article.

Nour Attorneys Team

Related Resources

Explore more of our insights on related topics:

• AI Regulations Compliance Requirements in the UAE
• Blockchain Legal Defense Strategies for Dubai Businesses
• Cryptocurrency Compliance Guidelines for UAE Operators
• Data Privacy Laws for Multinational Entities